i would like to force my network users for their own protection to use to https://www.facebook.com instead of http://www.facebook.com
how???
hello!
try this
/ip firewall nat
add action=dst-nat chain=dstnat comment="https facebook" content=facebook.com \
dst-port=80 protocol=tcp to-addresses=66.220.158.70 to-ports=443
didn’t work !
As could be expected. That rule silently redirects port 80 to 443 and browser can’t know that it happened. So it still talks http, instead of required https. You need to intercept http connection and send proper redirect to https back to browser.
It should be possible using web proxy, I’m just not sure about the one in RouterOS. First, when I add redirect to https://www.facebook.com, it sends this to browser:
Location: http://https://www.facebook.com
Seems like a bug to me (I currently have ROS 5.18, it may be different in newer version). And I also don’t see an option to keep the path, so you could redirect http://server/some/path/ to https://server/some/path/ and not only to home page (but maybe I just missed that, I don’t use proxy much).
i use L7 script and work well
can you provide me with the layer7 script?
echo!
what is your solution?
add action=drop chain=forward comment=force_facebook_drop disabled=no in-interface=your_lan_network layer7-protocol=facebook
/ip firewall layer7-protocol
add comment=“” name=facebook regexp=facebook
That is BAD idea. That will simply block http facebook (and all other sites that have the word facebook anywhere in it!)… it won’t redirect. Now, you will get people calling you to say that the “Internet is broken.”
is there any working solutions then?
It depends.
If you really want it and you’re talking about some small IPv4-only office network or something around that size, then wait for hopefully stable MetaRouter in ROS 5.21, create one with OpenWRT and the simplest proxy server with configurable redirects support you can find, transparently redirect http traffic to it, configure the required http redirect rule and you’re set.
Other cases will range from more challenging to almost impossible.
For their own protection?!?!? That doesn’t make sense. What protection will this give them? It won’t protect their login information, because all of the logins are already on https.
lol
let me type in your language then
i want them to be working on https://www.facebook.com and not on http://www.facebook.com !
I understand what you want. I don’t understand WHY.
you don’t really get any additional protection from it!
are you sure?
not even sniffing 
seriously? Sniffing Facebook posts? LOL!
how about pictures and comments and even email addresses and most important http passwords?
login is ALWAYS https in Facebook. So that point is moot.